HACKERS BREACH F5 BIG-IP APM DEVICES TO DEPLOY LINUX ROOTKIT

Summary from the TLDR InfoSec newsletter

There is a malware campaign targeting F5 BIG-IP APM devices that exploits a critical RCE vulnerability and injects a fileless web shell. A distinct installer deploys the payload by infecting the Apache executable and modifying SELinux configurations. ESET researchers identified the malware as PoisonedRefresh.